felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): rename all systemd generator.

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-22 20:51:10 +00:00
parent ba1cad7f73
commit 07acb8043b
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
9 changed files with 110 additions and 75 deletions
Download patch file Download diff file Expand all files Collapse all files

25
apparmor.d/groups/systemd/systemd-generator-fstab Normal file
View file

@ -0,0 +1,25 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-fstab-generator
profile systemd-generator-fstab @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
capability dac_override,
@{exec_path} mr,
/etc/fstab r,
@{run}/systemd/generator/** w,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-fstab>
}

25
apparmor.d/groups/systemd/systemd-generator-getty Normal file
View file

@ -0,0 +1,25 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-getty-generator
profile systemd-generator-getty @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>
@{exec_path} mr,
@{run}/systemd/generator/getty.target.wants/ w,
@{run}/systemd/generator/getty.target.wants/serial-getty@ttyS@{int}.service w,
@{sys}/devices/virtual/tty/console/active r,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-getty>
}

30
apparmor.d/groups/systemd/systemd-generator-gpt-auto Normal file
View file

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-gpt-auto-generator
profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/disks-read>
include <abstractions/systemd-common>
capability sys_admin,
@{exec_path} mr,
/ r,
/boot/ r,
/efi/ r,
/etc/fstab r,
@{run}/systemd/generator.late/**.{,auto}mount w,
@{run}/systemd/generator.late/local-fs.target.wants/ w,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-gpt-auto>
}

6
apparmor.d/groups/systemd/systemd-xdg-autostart-generator → apparmor.d/groups/systemd/systemd-generator-user-autostart
View file

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator
profile systemd-xdg-autostart-generator @{exec_path} {
profile systemd-generator-user-autostart @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
@ -23,5 +23,5 @@ profile systemd-xdg-autostart-generator @{exec_path} {
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-xdg-autostart-generator>
include if exists <local/systemd-generator-user-autostart>
}

4
apparmor.d/groups/systemd/systemd-environment-d-generator → apparmor.d/groups/systemd/systemd-generator-user-environment
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/user-environment-generators/*
profile systemd-environment-d-generator @{exec_path} {
profile systemd-generator-user-environment @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
@ -28,5 +28,5 @@ profile systemd-environment-d-generator @{exec_path} {
/dev/tty rw,
include if exists <local/systemd-environment-d-generator>
include if exists <local/systemd-generator-user-environment>
}

27
apparmor.d/groups/systemd/systemd-user-generators-autostart
View file

@ -1,27 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-generators/systemd-xdg-autostart-generator
profile systemd-user-generators-autostart @{exec_path} {
include <abstractions/base>
ptrace (read) peer=unconfined,
@{exec_path} mr,
/etc/xdg/autostart/{,*.desktop} r,
owner @{run}/user/@{uid}/systemd/generator.late/{,**} rw,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/1/environ r,
@{PROC}/@{pids}/cgroup r,
include if exists <local/systemd-user-generators-autostart>
}

21
apparmor.d/groups/systemd/systemd-user-generators-environment
View file

@ -1,21 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
profile systemd-user-generators-environment @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/etc/environment.d/{,**} r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
include if exists <local/systemd-user-generators-environment>
}

6
apparmor.d/groups/systemd/systemd-user-generators-flatpak
View file

@ -6,11 +6,11 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-environment-generators/60-flatpak
profile systemd-user-generators-flatpak @{exec_path} {
@{exec_path} = @{lib}/systemd/user-environment-generators/60-flatpak
profile systemd-generator-user-environment-flatpak @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/systemd-user-generators-flatpak>
include if exists <local/systemd-generator-user-environment-flatpak>
}